CVE-2025-62035CWE-502insecure-deserialization

CVE-2025-62035

High · published November 6, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

🚨 A sneaky deserialization vulnerability lurks in uxper Togo, affecting all versions below 1.0.4! 🔥 Think of it like a careless chef who follows a recipe without checking the ingredients; they'll whip up a dish with all sorts of unexpected flavors, or worse, allergens! This vulnerability allows untrusted data to be processed without proper checks, creating a recipe for disaster. An attacker could potentially send crafted data that the application will blindly execute, leading to unauthorized access or even complete system takeover. If exploited, this vulnerability could wreak absolute havoc by allowing malicious payloads to run freely within your system.

Put simply

Think of it like a careless chef who follows a recipe without checking the ingredients; they'll whip up a dish with all sorts of unexpected flavors, or worse, allergens! This vulnerability allows untrusted data to be processed without proper checks, creating a recipe for disaster. This vulnerability arises from the application's failure to validate input during the deserialization process, meaning untrusted data can be manipulated and executed without proper safeguards.

What to do

An attacker could potentially send crafted data that the application will blindly execute, leading to unauthorized access or even complete system takeover. If exploited, this vulnerability could wreak absolute havoc by allowing malicious payloads to run freely within your system. Immediate action is required! Update uxper Togo to version 1.0.4 or higher to mitigate this risk. Additionally, review your deserialization process to ensure robust validation and sanitization of all incoming data. You've got this! With these steps, you'll be on your way to securing your application in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00449 · 38.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:55Z
    WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability
    cvelistv5